@zlink-systems/framework 0.29.0 → 0.30.0

package/src/internal.ts

@@ -1,5 +1,6 @@
 /** Test and companion-package integration surface. It is not exported by package.json. */
 export * from './index';
+export { requireValidSendTimeoutMs } from './contracts/Configuration/SendTimeoutValidation';
 export * from './runtime/diagnostics';
 export * from './runtime/host';
 export * from './runtime/admission';

package/src/runtime/actors/actor-handoff.ts

@@ -3,6 +3,7 @@ import { type ActorRef, type RoutingId, ZLinkFrameworkException } from '../../co
 import type { Message } from '../../contracts/Common/Message';
 import { zlinkDefaultLocationOptions } from '../../contracts/Locations/Options';
 import { releaseApplicationJobPermitForDurableHandoff } from '../application-jobs/application-job-queue-scope';
+import type { ApplicationJobOrigin } from '../application-jobs/contracts';
 import { ZLinkBufferMessage as RuntimeMessage } from '../backend/runtime-message';
 import {
   MessageFollowSuppressionRegistry,
@@ -108,7 +109,8 @@ export interface ZLinkActorHandoffPreparedReplayAdmission {
 }
 
 export type ZLinkActorHandoffReplayPreparation = (
-  signal: AbortSignal
+  signal: AbortSignal,
+  origin: ApplicationJobOrigin
 ) => Promise<ZLinkActorHandoffPreparedReplayAdmission>;
 
 export interface ZLinkActorHandoffPrefixAdmission {
@@ -137,6 +139,7 @@ export type ZLinkActorHandoffPrefixQueue = (
 ) => ZLinkActorHandoffPrefixAdmission;
 
 interface PendingPacket {
+  readonly origin: ApplicationJobOrigin;
   readonly packet: ZLinkActorHandoffPacket;
   readonly resolve?: (value: unknown) => void;
   readonly reject?: (reason: unknown) => void;
@@ -554,7 +557,7 @@ export class ZLinkActorHandoffCoordinator {
           try {
             await waitForHandoffReplayStart(release.start, signal);
             if (release.preparation !== undefined) {
-              const next = await release.preparation(signal);
+              const next = await release.preparation(signal, pending.origin);
               if (signal.aborted) {
                 next.cancel();
                 throw signal.reason;
@@ -765,6 +768,7 @@ export class ZLinkActorHandoffCoordinator {
   }
 
   capture(
+    origin: ApplicationJobOrigin,
     actorId: string,
     parts: readonly Message[],
     returnResponse = false,
@@ -823,7 +827,7 @@ export class ZLinkActorHandoffCoordinator {
         this.reportRequestFrame(actorId, packet);
       }
       if (!returnResponse) {
-        handoff.pending.push({ packet });
+        handoff.pending.push({ packet, origin });
         // The durable handoff now owns this record. Return the ingress permit
         // before waiting for a later replay, which must acquire its own fresh
         // application-job permit.
@@ -859,7 +863,12 @@ export class ZLinkActorHandoffCoordinator {
         }, RELOCATION_REPLY_RETENTION_MS);
         route.deadline.unref();
         this.replyRoutes.set(source.replyRouteId, route);
-        handoff.pending.push({ packet: requestPacket, resolve, reject });
+        handoff.pending.push({
+          packet: requestPacket,
+          origin,
+          resolve,
+          reject
+        });
       });
       releaseApplicationJobPermitForDurableHandoff();
       if (handoff.prefixRelease !== undefined) {

package/src/runtime/actors/actor-runtime-contracts.ts

@@ -49,6 +49,10 @@ export interface ZLinkActorManagerOptions {
     signal?: AbortSignal
   ) => Promise<ZLinkActorCreateResponse | undefined>;
   readonly actorDestroyedCleanup?: (actorId: string) => void;
+  readonly terminateActorActivation?: (
+    actor: ZLinkActor,
+    terminal: () => Promise<void>
+  ) => Promise<void>;
   readonly publishActorAuthority?: (
     actorType: string,
     actorRef: ActorRef,

package/src/runtime/actors/index.ts

@@ -29,6 +29,7 @@ import {
   wireReplyFailureException
 } from '../framework-errors-internal';
 import { disposeLifecycleHandlers } from '../handlers/handler-instance-scope';
+import { currentZLinkActorExecution } from './actor-execution-context';
 import { encodeFrameworkPayloadMessage } from '../messaging/payload-codec';
 import { ZLinkActorCreationCoordinator, type ZLinkActorCreateRequest } from './actor-creation';
 import type { ZLinkActorManagerOptions } from './actor-runtime-contracts';
@@ -217,34 +218,43 @@ export class DefaultZLinkActorManager implements ZLinkActorManager {
     const completions = this.options.nativeActorCompletionTableProvider?.();
     const entryNodeRid = state.entryNodeRid ?? current.nodeRid;
     if (node === undefined || completions === undefined) return false;
-    const destroyTask = state.getOrStartDestroy(entryNodeRid, async (nativeRef) => {
-      if (nativeRef !== undefined) {
-        const completion = await completions.submit(() => node.destroyActor(nativeRef, 0), signal);
-        try {
-          if (completion.terminalResult !== 0 || completion.failureErrno !== 0) {
-            //  Classify the (terminal, fine) pair via the shared translator
-            //  (spec 32-framework-error-model:83-118, 99-108) instead of
-            //  collapsing every destroy failure to NotFound; genuine
-            //  route-not-found fine codes still yield NotFound through the
-            //  shared table.
-            throw wireReplyFailureException(
-              completion.terminalResult,
-              completion.failureErrno,
-              `Actor '${actor.actorId}' destroy failed with result '${completion.terminalResult}' and errno '${completion.failureErrno}'.`
-            );
+    const destroyTask = state.getOrStartDestroy(entryNodeRid, (nativeRef) =>
+      this.terminateActor(state, async () => {
+        if (nativeRef !== undefined) {
+          const completion = await completions.submit(
+            () => node.destroyActor(nativeRef, 0),
+            signal
+          );
+          try {
+            if (completion.terminalResult !== 0 || completion.failureErrno !== 0) {
+              //  Classify the (terminal, fine) pair via the shared translator
+              //  (spec 32-framework-error-model:83-118, 99-108) instead of
+              //  collapsing every destroy failure to NotFound; genuine
+              //  route-not-found fine codes still yield NotFound through the
+              //  shared table.
+              throw wireReplyFailureException(
+                completion.terminalResult,
+                completion.failureErrno,
+                `Actor '${actor.actorId}' destroy failed with result '${completion.terminalResult}' and errno '${completion.failureErrno}'.`
+              );
+            }
+          } finally {
+            closeMeshCompletion(completion);
           }
-        } finally {
-          closeMeshCompletion(completion);
+          state.markNativeActorDestroyed(nativeRef);
         }
-        state.markNativeActorDestroyed(nativeRef);
-      }
-      if (state.actorType !== undefined && state.ownsLocation) {
-        await this.options.locationLifecycle?.releaseActor(state.actorType, actor.actorId, current);
-      }
-      await this.finalizeDestroyedActor(actor.actorId, state);
-    });
+        if (state.actorType !== undefined && state.ownsLocation) {
+          await this.options.locationLifecycle?.releaseActor(
+            state.actorType,
+            actor.actorId,
+            current
+          );
+        }
+        await this.finalizeDestroyedActor(actor.actorId, state);
+      })
+    );
     try {
-      await destroyTask;
+      await this.awaitActorDestroy(state, destroyTask);
     } catch (error) {
       state.clearFailedDestroy(destroyTask);
       throw error;
@@ -548,6 +558,29 @@ export class DefaultZLinkActorManager implements ZLinkActorManager {
       this.options.metrics?.change(METRIC_NAMES.ActorCount, -1);
     }
   }
+
+  private terminateActor(
+    state: ZLinkActorRuntimeState,
+    terminal: () => Promise<void>
+  ): Promise<void> {
+    const actor = state.actor;
+    const completion =
+      actor === undefined || this.options.terminateActorActivation === undefined
+        ? terminal()
+        : this.options.terminateActorActivation(actor, terminal);
+    return completion;
+  }
+
+  private awaitActorDestroy(
+    state: ZLinkActorRuntimeState,
+    completion: Promise<void>
+  ): Promise<void> {
+    if (currentZLinkActorExecution()?.actorId === state.actorId) {
+      this.detachedTaskRunner.runDetached('Actor terminal cleanup', () => completion);
+      return Promise.resolve();
+    }
+    return completion;
+  }
   async getOrCreateActor(
     actorId: string,
     actorType: string,
@@ -648,25 +681,27 @@ export class DefaultZLinkActorManager implements ZLinkActorManager {
         `Actor '${actor.context.actorId}' must leave its current SPOT before destroy.`
       );
     }
-    const destroyTask = state.getOrStartDestroy(entryNodeRid, async (actorRef) => {
-      const destroyedActorRef =
-        actorRef === undefined ? undefined : toFrameworkActorRef(actorRef, state.meshName ?? '');
-      if (actorRef !== undefined) {
-        await node.destroyActor(actorRef, 0, destroySignal);
-        state.markNativeActorDestroyed(actorRef);
-      }
-      if (state.actorType !== undefined && state.ownsLocation) {
-        await this.options.locationLifecycle?.releaseActor(
-          state.actorType,
-          actor.context.actorId,
-          destroyedActorRef
-        );
-      }
-      await this.finalizeDestroyedActor(actor.context.actorId, state);
-    });
+    const destroyTask = state.getOrStartDestroy(entryNodeRid, (actorRef) =>
+      this.terminateActor(state, async () => {
+        const destroyedActorRef =
+          actorRef === undefined ? undefined : toFrameworkActorRef(actorRef, state.meshName ?? '');
+        if (actorRef !== undefined) {
+          await node.destroyActor(actorRef, 0, destroySignal);
+          state.markNativeActorDestroyed(actorRef);
+        }
+        if (state.actorType !== undefined && state.ownsLocation) {
+          await this.options.locationLifecycle?.releaseActor(
+            state.actorType,
+            actor.context.actorId,
+            destroyedActorRef
+          );
+        }
+        await this.finalizeDestroyedActor(actor.context.actorId, state);
+      })
+    );
 
     try {
-      await destroyTask;
+      await this.awaitActorDestroy(state, destroyTask);
     } catch (error) {
       state.clearFailedDestroy(destroyTask);
       throw error;

package/src/runtime/application-jobs/application-ingress-record-owner.ts

@@ -1,4 +1,8 @@
-import type { ApplicationJobPermitPort, ApplicationJobQueuePort } from './contracts';
+import type {
+  ApplicationJobOrigin,
+  ApplicationJobPermitPort,
+  ApplicationJobQueuePort
+} from './contracts';
 
 export type ApplicationJobRecordDomain = 'application' | 'infrastructure';
 
@@ -85,6 +89,10 @@ export class ApplicationJobRecordLease implements ApplicationJobPermitPort {
     private readonly permit: ApplicationJobPermitPort
   ) {}
 
+  get origin(): ApplicationJobOrigin {
+    return this.shared.origin;
+  }
+
   markApplicationQueued(): void {
     // The owner classifies and marks the child atomically when it is created;
     // downstream dispatch must not mutate queue accounting a second time.
@@ -132,12 +140,14 @@ class SharedIngressRecordState {
   private jobCount = 0;
   private initialPermit?: ApplicationJobPermitPort;
   private recordClosed = false;
+  readonly origin: ApplicationJobOrigin;
 
   constructor(
     private readonly queue: ApplicationJobQueuePort,
     initialPermit: ApplicationJobPermitPort,
     private readonly record: IngressRecordPort
   ) {
+    this.origin = initialPermit.origin;
     this.initialPermit = initialPermit;
   }
 
@@ -160,7 +170,7 @@ class SharedIngressRecordState {
   }
 
   acquirePermit(signal: AbortSignal): Promise<ApplicationJobPermitPort> {
-    return this.queue.acquire(signal);
+    return this.queue.acquire(signal, this.origin);
   }
 
   createJob(

package/src/runtime/application-jobs/application-job-queue-scope.ts

@@ -1,6 +1,6 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
 
-import type { ApplicationJobPermitPort } from './contracts';
+import type { ApplicationJobOrigin, ApplicationJobPermitPort } from './contracts';
 
 interface ApplicationJobPermitScope {
   readonly permit: ApplicationJobPermitPort;
@@ -42,6 +42,11 @@ export function hasApplicationJobPermit(): boolean {
   return applicationJobPermitScope.getStore() !== undefined;
 }
 
+/** Keeps the ingress origin when a durable record later reacquires its permit. */
+export function currentApplicationJobOrigin(): ApplicationJobOrigin {
+  return applicationJobPermitScope.getStore()!.permit.origin;
+}
+
 /** Re-enters the captured permit scope when a serial executor runs later. */
 export function bindApplicationJobPermit<TResult, TArgument>(
   callback: (argument?: TArgument) => Promise<TResult> | TResult

package/src/runtime/application-jobs/contracts.ts

@@ -1,4 +1,7 @@
+export type ApplicationJobOrigin = 'local' | 'remote';
+
 export interface ApplicationJobPermitPort {
+  readonly origin: ApplicationJobOrigin;
   markApplicationQueued(): void;
   /** Transfers ingress-record cleanup to a detached exact-target handler turn. */
   detachForHandlerTurn?(): void;
@@ -7,7 +10,17 @@ export interface ApplicationJobPermitPort {
 }
 
 export interface ApplicationJobQueuePort {
-  acquire(signal?: AbortSignal): Promise<ApplicationJobPermitPort>;
+  acquire(
+    signal: AbortSignal | undefined,
+    origin: ApplicationJobOrigin
+  ): Promise<ApplicationJobPermitPort>;
+  /** Returns a grant now, or registers one FIFO waiter that later calls resume. */
+  acquireOrResume(
+    resume: (permit: ApplicationJobPermitPort) => void,
+    reject: (reason: unknown) => void,
+    signal: AbortSignal | undefined,
+    origin: ApplicationJobOrigin
+  ): ApplicationJobPermitPort | undefined;
   registerReceiveFlowTarget?(
     identity: object,
     applyState: (state: 'running' | 'paused') => void,

package/src/runtime/backend/contracts/index.ts

@@ -6,7 +6,7 @@ import type {
   ZLinkBackendReceived,
   ZLinkBackendTopicMessage
 } from '../runtime-values';
-import type { CoreHwmBudgetSnapshot } from '@zlink-systems/zlink';
+import type { CoreHwmBudgetSnapshot, ReceiveFlowState } from '@zlink-systems/zlink';
 import { type ZLinkBackendRecvFlags, type ZLinkBackendSendFlags } from '../runtime-values';
 export * from '../runtime-values';
 type MessageLike = ZLinkBackendMessageLike;
@@ -27,6 +27,7 @@ import type {
 import type { RoutingId } from '../../../contracts';
 import type { ZLinkCoreHwmOptions } from '../../../contracts/Configuration';
 import type { ZLinkSubmitResult } from '../../messaging/submission-result';
+import type { ZLinkMeshCompletionHandler } from '../mesh-completion-table';
 import type { Message } from '../../../contracts/Common/Message';
 import type {
   ServiceSpotMessageFollowSeal,
@@ -38,6 +39,7 @@ import type {
   ServiceActorCreateRecord,
   ServiceDirectSpotRouteFence,
   ServiceInstanceRouteFence,
+  ServiceInstanceColdActivationTarget,
   ServiceUserSpotCloseRecord,
   ServiceUserSpotCreateRecord
 } from '../../foundation/service-stateful-wire-codec';
@@ -112,26 +114,14 @@ export interface ZLinkBackendMeshNode {
   selectObjectPlacement(stableType: string): ZLinkBackendObjectPlacement;
   instanceSpotPlacementTypes?(): readonly string[];
   sendToMissingInstanceSpot(
-    target: {
-      readonly targetNodeRid: string;
-      readonly targetNodeGeneration: bigint;
-      readonly targetSpotId: string;
-      readonly stableType: string;
-      readonly descriptorVersion: string;
-    },
+    target: ServiceInstanceColdActivationTarget,
     parts: ZLinkBackendMessageLike | readonly ZLinkBackendMessageLike[],
     deadlineUnixMs: bigint,
     sourceSpotId?: string,
     metadata?: ReadonlyMap<string, string>
   ): Promise<SubmitResult>;
   requestToMissingInstanceSpot(
-    target: {
-      readonly targetNodeRid: string;
-      readonly targetNodeGeneration: bigint;
-      readonly targetSpotId: string;
-      readonly stableType: string;
-      readonly descriptorVersion: string;
-    },
+    target: ServiceInstanceColdActivationTarget,
     parts: ZLinkBackendMessageLike | readonly ZLinkBackendMessageLike[],
     deadlineUnixMs: bigint,
     sourceSpotId?: string,
@@ -390,6 +380,7 @@ export interface ZLinkBackendMeshNode {
     timeoutMs?: number
   ): MeshOperationId;
   setReadyHandler(handler: (readyDomains: number) => number): void;
+  setCompletionHandler(handler: ZLinkMeshCompletionHandler): void;
   createReadyBatch(capacity: number): ReadyBatch;
   createReceiveBatch(messageCapacity: number, partCapacity: number): ReceiveBatch;
   drainReady(
@@ -476,7 +467,6 @@ export interface ZLinkBackendSocket extends ZLinkBackendObject {
   readonly lastEndpoint?: string;
   bind(endpoint: string): void;
   setChannelName(channelName: string): void;
-  setReceiveFlowState?(state: 0 | 1): void;
   dispose(): Promise<void>;
 }
 
@@ -486,7 +476,7 @@ export interface ZLinkBackendConnectableSocket extends ZLinkBackendSocket {
 }
 
 export interface ZLinkBackendDealerSocket extends ZLinkBackendConnectableSocket {
-  setReceiveFlowState(state: 0 | 1): void;
+  receiveAdmission?: import('../../foundation/service-liveness-registry').ServiceLivenessConnection;
   setRoutingId(routingId: RoutingId): void;
   peerWeight: number;
   sendHighWaterMark: number;
@@ -515,7 +505,7 @@ export interface ZLinkBackendRequestOperation {
 }
 
 export interface ZLinkBackendRouterSocket extends ZLinkBackendConnectableSocket {
-  setReceiveFlowState(state: 0 | 1): void;
+  setReceiveFlowState(state: ReceiveFlowState): void;
   /** Enables the native probe handshake for manually configured routes. */
   setProbe(enabled: boolean): void;
   peerWeight: number;
@@ -549,6 +539,7 @@ export interface ZLinkBackendRouterSocket extends ZLinkBackendConnectableSocket
 }
 
 export interface ZLinkBackendPublisherSocket extends ZLinkBackendSocket {
+  lingerMs: number;
   sendTimeoutMs: number;
   sendHighWaterMark: number;
   noDrop: boolean;
@@ -739,6 +730,7 @@ export interface ZLinkMeshBackendAdapter {
       readonly trustProfile?: string;
       readonly applicationJobQueue: import('../../application-jobs/contracts').ApplicationJobQueuePort;
       readonly applicationJobReceiveFlowFailureSink?: (error: unknown) => void;
+      readonly infrastructureTaskRunner?: import('../../spots/spot-actor-join-dispatch').ZLinkDetachedTaskRunner;
       readonly peerAdmissionSealed?: () => boolean;
     }
   ): ZLinkBackendMeshNode;

package/src/runtime/backend/mesh-completion-table.ts

@@ -27,8 +27,14 @@ interface PendingCompletion {
   readonly removeAbort?: () => void;
 }
 
+export type ZLinkMeshCompletionTerminal = Pick<ReceiveRecord, 'operationId' | 'terminalResult'>;
+export type ZLinkMeshCompletionHandler = (
+  terminal: ZLinkMeshCompletionTerminal,
+  materialize: () => ReceiveRecord
+) => void;
+
 export class ZLinkMeshCompletionTable {
-  private readonly pending = new Map<string, PendingCompletion>();
+  private readonly pending = new Map<string | symbol, PendingCompletion>();
   private disposed = false;
 
   constructor(
@@ -36,10 +42,9 @@ export class ZLinkMeshCompletionTable {
   ) {}
 
   /**
-   * Submits and registers without yielding control to the event loop. Mesh
-   * completion dispatch is asynchronous, so a completion cannot overtake the
-   * registration. The table therefore does not need to retain responses that
-   * arrived before their waiter.
+   * Reserves the dispatcher slot before transport submission. The backend
+   * observes native terminals through Promises, so identity binding finishes
+   * before the terminal callback can run, without an infrastructure pump.
    */
   submit(operation: () => MeshOperationId, signal?: AbortSignal): Promise<ZLinkMeshCompletion> {
     if (this.isDisposed()) {
@@ -50,17 +55,8 @@ export class ZLinkMeshCompletionTable {
         signal.reason ?? new DOMException('The operation was aborted.', 'AbortError')
       );
     }
-    const operationId = operation();
-    // The backend submission callback can synchronously re-enter `dispose()`.
-    // TypeScript's control-flow analysis cannot observe mutation through it.
-    if (this.disposed) {
-      return Promise.reject(new Error('Mesh completion table is disposed.'));
-    }
-    const key = operationIdentityKey(operationId);
-    if (this.pending.has(key)) {
-      return Promise.reject(new Error(`Mesh operation '${key}' is already pending.`));
-    }
     return new Promise((resolve, reject) => {
+      let key: string | symbol = Symbol();
       const abort = () => {
         this.pending.delete(key);
         reject(signal?.reason ?? new DOMException('The operation was aborted.', 'AbortError'));
@@ -70,12 +66,29 @@ export class ZLinkMeshCompletionTable {
         return;
       }
       signal?.addEventListener('abort', abort, { once: true });
-      this.pending.set(key, {
+      const entry: PendingCompletion = {
         resolve,
         reject,
         removeAbort:
           signal === undefined ? undefined : () => signal.removeEventListener('abort', abort)
-      });
+      };
+      this.pending.set(key, entry);
+      try {
+        const operationId = operation();
+        // dispose/abort can consume the reserved slot during submission.
+        if (!this.pending.delete(key)) return;
+        key = operationIdentityKey(operationId);
+        if (this.pending.has(key)) {
+          throw new Error(`Mesh operation '${key}' is already pending.`);
+        }
+        this.pending.set(key, entry);
+      } catch (error) {
+        // Remove only this submission's slot; a duplicate identity retains
+        // the original waiter.
+        if (this.pending.get(key) === entry) this.pending.delete(key);
+        entry.removeAbort?.();
+        reject(error);
+      }
     });
   }
 
@@ -83,7 +96,9 @@ export class ZLinkMeshCompletionTable {
     return this.disposed;
   }
 
-  complete(record: ReceiveRecord): void {
+  complete(record: ReceiveRecord): void;
+  complete(record: ZLinkMeshCompletionTerminal, materialize: () => ReceiveRecord): void;
+  complete(record: ZLinkMeshCompletionTerminal, materialize?: () => ReceiveRecord): void {
     const key = operationIdentityKey(record.operationId);
     const pending = this.pending.get(key);
     if (pending === undefined) {
@@ -97,7 +112,9 @@ export class ZLinkMeshCompletionTable {
     this.pending.delete(key);
     pending.removeAbort?.();
     try {
-      pending.resolve(retainCompletion(record));
+      pending.resolve(
+        retainCompletion(materialize === undefined ? (record as ReceiveRecord) : materialize())
+      );
     } catch (error) {
       pending.reject(error);
     }

package/src/runtime/backend/mesh-dispatch-pump.ts

@@ -253,7 +253,7 @@ export class ZLinkMeshDispatchPump {
   ): Promise<boolean> {
     let claimsDrained = 0;
     try {
-      for (;;) {
+      while (!this.disposed) {
         if (claimBudget !== undefined && claimsDrained >= claimBudget) {
           // Lifecycle work has priority, but a bounded turn lets application
           // work make progress when lifecycle records keep arriving.
@@ -282,19 +282,18 @@ export class ZLinkMeshDispatchPump {
               );
               const capacity =
                 owner.ordinaryIngressPreAdmitted === true ? MESH_DISPATCH_RECEIVE_CAPACITY : 1;
-              for (;;) {
-                let claimPermit =
-                  owner.terminalCompletion === true ||
-                  owner.ordinaryIngressPreAdmitted === true ||
-                  domain === ReadyDomain.Infrastructure
-                    ? undefined
-                    : await this.acquirePermit();
-                try {
-                  if (this.capacityStop.signal.aborted) return;
-                  ownerReceiveBatch.reset(capacity);
-                  const received = claim.recvBatch(ownerReceiveBatch, ZLINK_BACKEND_RECV_DONT_WAIT);
-                  if (!received.ok) break;
-                  // This owner keeps its claim while it drains, so its records stay in FIFO order.
+              let claimPermit =
+                owner.terminalCompletion === true ||
+                owner.ordinaryIngressPreAdmitted === true ||
+                domain === ReadyDomain.Infrastructure
+                  ? undefined
+                  : await this.acquirePermit();
+              try {
+                if (this.capacityStop.signal.aborted) return;
+                ownerReceiveBatch.reset(capacity);
+                const received = claim.recvBatch(ownerReceiveBatch, ZLINK_BACKEND_RECV_DONT_WAIT);
+                if (received.ok) {
+                  // The bounded batch stays in claim order until its records finish.
                   try {
                     for (const record of received.records) {
                       if (this.disposed) break;
@@ -327,8 +326,6 @@ export class ZLinkMeshDispatchPump {
                         if (permit === claimPermit) claimPermit = undefined;
                         await runWithApplicationJobPermit(permit, dispatch);
                       }
-                      const yieldTurn = this.yieldIfNeeded();
-                      if (yieldTurn !== undefined) await yieldTurn;
                     }
                   } finally {
                     // Batch ownership includes records whose dispatch never began,
@@ -338,14 +335,16 @@ export class ZLinkMeshDispatchPump {
                       record.releaseRetainedIngress?.();
                     }
                   }
-                } finally {
-                  claimPermit?.releaseAfterInternalProcessing();
                 }
+              } finally {
+                claimPermit?.releaseAfterInternalProcessing();
               }
             } finally {
               claim.release();
               if (receiveBatch === undefined) ownerReceiveBatch?.close();
             }
+            const yieldTurn = this.yieldIfNeeded();
+            if (yieldTurn !== undefined) await yieldTurn;
           };
           // An application worker drains the one owner it claimed. Infrastructure owners
           // drain independently, so a suspended owner does not hold the other claims.
@@ -366,10 +365,8 @@ export class ZLinkMeshDispatchPump {
         this.recordsSinceYield += 1;
         const yieldTurn = this.yieldIfNeeded();
         if (yieldTurn !== undefined) await yieldTurn;
-        if (!drained.hasResidue) {
-          return false;
-        }
       }
+      return false;
     } finally {
       readyBatch.reset();
     }
@@ -394,7 +391,7 @@ export class ZLinkMeshDispatchPump {
 
   private async acquirePermit(): Promise<ApplicationJobPermitPort | undefined> {
     try {
-      return await this.options.applicationJobQueue.acquire(this.capacityStop.signal);
+      return await this.options.applicationJobQueue.acquire(this.capacityStop.signal, 'remote');
     } catch (error) {
       if (this.disposed || this.capacityStop.signal.aborted) return undefined;
       throw error;

package/src/runtime/backend/node/node-backend-adapter-factory.ts

@@ -1,4 +1,9 @@
-import type { Context, CoreHwmBudgetSnapshot, TopicMessage } from '@zlink-systems/zlink';
+import type {
+  Context,
+  CoreHwmBudgetSnapshot,
+  ReceiveFlowState,
+  TopicMessage
+} from '@zlink-systems/zlink';
 import type { ZLinkCoreHwmOptions } from '../../../contracts/Configuration';
 import type {
   ZLinkBackendAdapterFactory,
@@ -60,10 +65,12 @@ class ZLinkNodeChannelBackendAdapter implements ZLinkChannelBackendAdapter {
   }
 
   createRouterSocket(context: ZLinkBackendContext): ZLinkBackendRouterSocket {
-    return wrapSocket(
-      zlink.createRouterSocket(asNodeContext(context)),
-      true
-    ) as unknown as ZLinkBackendRouterSocket;
+    const socket = zlink.createRouterSocket(asNodeContext(context));
+    const adapter = wrapSocket(socket, true);
+    adapter.setReceiveFlowState = (state: ReceiveFlowState): void => {
+      socket.setReceiveFlowState(state);
+    };
+    return adapter as unknown as ZLinkBackendRouterSocket;
   }
 
   createPublisherSocket(context: ZLinkBackendContext): ZLinkBackendPublisherSocket {